218 lines
7.6 KiB
Go
218 lines
7.6 KiB
Go
/*
|
|
|
|
Copyright 2019 The KubeSphere Authors.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
|
|
*/
|
|
package tenant
|
|
|
|
import (
|
|
"k8s.io/api/core/v1"
|
|
rbacv1 "k8s.io/api/rbac/v1"
|
|
apierrors "k8s.io/apimachinery/pkg/api/errors"
|
|
k8sinformers "k8s.io/client-go/informers"
|
|
"k8s.io/client-go/kubernetes"
|
|
"k8s.io/klog"
|
|
"kubesphere.io/kubesphere/pkg/apis/tenant/v1alpha1"
|
|
ksinformers "kubesphere.io/kubesphere/pkg/client/informers/externalversions"
|
|
"kubesphere.io/kubesphere/pkg/constants"
|
|
"kubesphere.io/kubesphere/pkg/models"
|
|
"kubesphere.io/kubesphere/pkg/models/iam"
|
|
"kubesphere.io/kubesphere/pkg/models/iam/policy"
|
|
"kubesphere.io/kubesphere/pkg/server/params"
|
|
"kubesphere.io/kubesphere/pkg/simple/client/mysql"
|
|
"strconv"
|
|
)
|
|
|
|
type Interface interface {
|
|
CreateNamespace(workspace string, namespace *v1.Namespace, username string) (*v1.Namespace, error)
|
|
DeleteNamespace(workspace, namespace string) error
|
|
DescribeWorkspace(username, workspace string) (*v1alpha1.Workspace, error)
|
|
ListWorkspaces(username string, conditions *params.Conditions, orderBy string, reverse bool, limit, offset int) (*models.PageableResponse, error)
|
|
ListNamespaces(username string, conditions *params.Conditions, orderBy string, reverse bool, limit, offset int) (*models.PageableResponse, error)
|
|
ListDevopsProjects(username string, conditions *params.Conditions, orderBy string, reverse bool, limit int, offset int) (*models.PageableResponse, error)
|
|
GetWorkspaceSimpleRules(workspace, username string) ([]policy.SimpleRule, error)
|
|
GetNamespaceSimpleRules(namespace, username string) ([]policy.SimpleRule, error)
|
|
CountDevOpsProjects(username string) (uint32, error)
|
|
DeleteDevOpsProject(username, projectId string) error
|
|
GetUserDevopsSimpleRules(username string, devops string) (interface{}, error)
|
|
}
|
|
|
|
type tenantOperator struct {
|
|
workspaces WorkspaceInterface
|
|
namespaces NamespaceInterface
|
|
am iam.AccessManagementInterface
|
|
devops DevOpsProjectOperator
|
|
}
|
|
|
|
func (t *tenantOperator) CountDevOpsProjects(username string) (uint32, error) {
|
|
return t.devops.GetDevOpsProjectsCount(username)
|
|
}
|
|
|
|
func (t *tenantOperator) DeleteDevOpsProject(username, projectId string) error {
|
|
return t.devops.DeleteDevOpsProject(projectId, username)
|
|
}
|
|
|
|
func (t *tenantOperator) GetUserDevopsSimpleRules(username string, projectId string) (interface{}, error) {
|
|
return t.devops.GetUserDevOpsSimpleRules(username, projectId)
|
|
}
|
|
|
|
func (t *tenantOperator) ListDevopsProjects(username string, conditions *params.Conditions, orderBy string, reverse bool, limit int, offset int) (*models.PageableResponse, error) {
|
|
return t.devops.ListDevOpsProjects(conditions.Match["workspace"], username, conditions, orderBy, reverse, limit, offset)
|
|
}
|
|
|
|
func (t *tenantOperator) DeleteNamespace(workspace, namespace string) error {
|
|
return t.workspaces.DeleteNamespace(workspace, namespace)
|
|
}
|
|
|
|
func New(client kubernetes.Interface, informers k8sinformers.SharedInformerFactory, ksinformers ksinformers.SharedInformerFactory, db *mysql.Database) Interface {
|
|
amOperator := iam.NewAMOperator(informers)
|
|
return &tenantOperator{
|
|
workspaces: newWorkspaceOperator(client, informers, ksinformers, amOperator, db),
|
|
namespaces: newNamespaceOperator(client, informers, amOperator),
|
|
am: amOperator,
|
|
}
|
|
}
|
|
|
|
func (t *tenantOperator) CreateNamespace(workspaceName string, namespace *v1.Namespace, username string) (*v1.Namespace, error) {
|
|
return t.namespaces.CreateNamespace(workspaceName, namespace, username)
|
|
}
|
|
|
|
func (t *tenantOperator) DescribeWorkspace(username, workspaceName string) (*v1alpha1.Workspace, error) {
|
|
workspace, err := t.workspaces.GetWorkspace(workspaceName)
|
|
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
if username != "" {
|
|
workspace = t.appendAnnotations(username, workspace)
|
|
}
|
|
|
|
return workspace, nil
|
|
}
|
|
|
|
func (t *tenantOperator) ListWorkspaces(username string, conditions *params.Conditions, orderBy string, reverse bool, limit, offset int) (*models.PageableResponse, error) {
|
|
|
|
workspaces, err := t.workspaces.SearchWorkspace(username, conditions, orderBy, reverse)
|
|
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
// limit offset
|
|
result := make([]interface{}, 0)
|
|
for i, workspace := range workspaces {
|
|
if len(result) < limit && i >= offset {
|
|
workspace := t.appendAnnotations(username, workspace)
|
|
result = append(result, workspace)
|
|
}
|
|
}
|
|
|
|
return &models.PageableResponse{Items: result, TotalCount: len(workspaces)}, nil
|
|
}
|
|
|
|
func (t *tenantOperator) GetWorkspaceSimpleRules(workspace, username string) ([]policy.SimpleRule, error) {
|
|
clusterRules, err := t.am.GetClusterPolicyRules(username)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
// cluster-admin
|
|
if iam.RulesMatchesRequired(clusterRules, rbacv1.PolicyRule{
|
|
Verbs: []string{"*"},
|
|
APIGroups: []string{"*"},
|
|
Resources: []string{"*"},
|
|
}) {
|
|
return t.am.GetWorkspaceRoleSimpleRules(workspace, constants.WorkspaceAdmin), nil
|
|
}
|
|
|
|
workspaceRole, err := t.am.GetWorkspaceRole(workspace, username)
|
|
|
|
// workspaces-manager
|
|
if iam.RulesMatchesRequired(clusterRules, rbacv1.PolicyRule{
|
|
Verbs: []string{"*"},
|
|
APIGroups: []string{"*"},
|
|
Resources: []string{"workspaces", "workspaces/*"},
|
|
}) {
|
|
return t.am.GetWorkspaceRoleSimpleRules(workspace, constants.WorkspacesManager), nil
|
|
}
|
|
|
|
if err != nil {
|
|
if apierrors.IsNotFound(err) {
|
|
return []policy.SimpleRule{}, nil
|
|
}
|
|
|
|
klog.Error(err)
|
|
return nil, err
|
|
}
|
|
|
|
return t.am.GetWorkspaceRoleSimpleRules(workspace, workspaceRole.Annotations[constants.DisplayNameAnnotationKey]), nil
|
|
}
|
|
|
|
func (t *tenantOperator) GetNamespaceSimpleRules(namespace, username string) ([]policy.SimpleRule, error) {
|
|
clusterRules, err := t.am.GetClusterPolicyRules(username)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
rules, err := t.am.GetPolicyRules(namespace, username)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
rules = append(rules, clusterRules...)
|
|
|
|
return iam.ConvertToSimpleRule(rules), nil
|
|
}
|
|
|
|
func (t *tenantOperator) appendAnnotations(username string, workspace *v1alpha1.Workspace) *v1alpha1.Workspace {
|
|
workspace = workspace.DeepCopy()
|
|
if workspace.Annotations == nil {
|
|
workspace.Annotations = make(map[string]string)
|
|
}
|
|
|
|
if ns, err := t.ListNamespaces(username, ¶ms.Conditions{Match: map[string]string{constants.WorkspaceLabelKey: workspace.Name}}, "", false, 1, 0); err == nil {
|
|
workspace.Annotations["kubesphere.io/namespace-count"] = strconv.Itoa(ns.TotalCount)
|
|
}
|
|
|
|
if devops, err := t.ListDevopsProjects(username, ¶ms.Conditions{Match: map[string]string{"workspace": workspace.Name}}, "", false, 1, 0); err == nil {
|
|
workspace.Annotations["kubesphere.io/devops-count"] = strconv.Itoa(devops.TotalCount)
|
|
}
|
|
|
|
userCount, err := t.workspaces.CountUsersInWorkspace(workspace.Name)
|
|
|
|
if err == nil {
|
|
workspace.Annotations["kubesphere.io/member-count"] = strconv.Itoa(userCount)
|
|
}
|
|
return workspace
|
|
}
|
|
|
|
func (t *tenantOperator) ListNamespaces(username string, conditions *params.Conditions, orderBy string, reverse bool, limit, offset int) (*models.PageableResponse, error) {
|
|
|
|
namespaces, err := t.namespaces.Search(username, conditions, orderBy, reverse)
|
|
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
// limit offset
|
|
result := make([]interface{}, 0)
|
|
for i, v := range namespaces {
|
|
if len(result) < limit && i >= offset {
|
|
result = append(result, v)
|
|
}
|
|
}
|
|
|
|
return &models.PageableResponse{Items: result, TotalCount: len(namespaces)}, nil
|
|
}
|